T09 · Insecure Skill Coding Practices
Warning
- Location
bin/cli.js:40- Finding
Feishu App Secret Exposed Through Command-Line Arguments
- Content
View full analysis
', '飞书应用ID（覆盖环境变量）') .option('--app-secret ', '飞书应用密钥（覆盖环境变量）') .action(async (options) => { try { if (options.appId) process.env.FEISHU_APP_ID = options.appId; if (options.appSecret) process.env.FEISHU_APP_SECRET = options.appSecret; ``` Equivalent `--app-secret` handling is repeated across every major CLI command. ### Technical Analysis The CLI permits the Feishu App Secret to be supplied directly as a command-line argument. Command-line arguments are not an appropriate secret transport mechanism because they can be exposed through: - Shell history files. - Process listings and operating-system process inspection interfaces. - Terminal session logging. - Job schedulers, command auditing, and monitoring platforms. - Diagnostic reports that capture process command lines. Copying the secret from `options.appSecret` into `process.env.FEISHU_APP_SECRET` does not remove it from `process.argv`, the parent shell's history, or external process telemetry. The secret grants application-level authentication through Feishu's tenant access-token endpoint. Its effective authority is determined by the permissions granted to the associated Feishu application. ### Attack Path 1. A user invokes a command such as: ```bash node bin/cli.js get \ --document-id dcnxxxxxx \ --app-id cli_xxxxxx \ --app-secret real_secret_value ``` 2. The complete command is recorded in shell history or remains visible in process metadata while the command runs. 3. A local user, process-monitoring agent, log collector, or party with access to the user's shell history obtains the secret. 4 ...[truncated 834 chars]- Remediation
View remediation